Cyprus FDI screening regime: What non-EU investors need to know before April 2026

Cyprus has always positioned itself as one of the most open investment destinations in the EU — low tax rates, straightforward corporate structures, and few barriers to entry for foreign capital. That changes, at least partially, on 2 April 2026.

From that date, Cyprus's first-ever Foreign Direct Investment (FDI) Screening Law comes into force. Non-EU investors acquiring stakes in companies that operate in certain strategic sectors will need prior government approval before they can complete their transactions. Get it wrong, and the consequences range from delays and conditions to fines running into six figures — or an order to unwind the deal entirely.

This article explains the new regime in plain English: who it applies to, which sectors are caught, what the process looks like, and what investors and advisers should be doing right now.

Why has Cyprus introduced FDI screening regime now

For most of its modern history, Cyprus actively resisted adopting an FDI screening framework. The logic was straightforward: the island's economic model is built on attracting foreign capital, and more regulatory friction means fewer deals.

That position became increasingly difficult to maintain. The EU's FDI Screening Regulation (Regulation 2019/452), which came into force in October 2020, established a cooperation framework requiring member states to share information and coordinate on sensitive cross-border investments. It did not mandate a national screening regime, but it created strong political pressure to have one.

By 2025, Cyprus was one of only two EU member states — alongside Croatia — that had not introduced national screening legislation. With Greece enacting its own FDI regime in May 2025 and the European Commission proposing to make screening mandatory across the bloc, the Cypriot government could no longer hold the line. On 30 October 2025, the House of Representatives passed Law 194(I)/2025. The law enters into force on 2 April 2026.

The message from Brussels has been consistent: open economies are welcome, but strategic assets need protecting. Cyprus has accepted that framing.

Who does this law apply to?

The regime targets foreign investors — specifically:

•  Natural persons who are not nationals of an EU, EEA or Swiss member state

•  Legal entities established outside the EU, EEA or Switzerland

•  Entities established within the EU/EEA/Switzerland but ultimately controlled by persons or entities from outside those jurisdictions

That last category is important. If you are a US, Israeli, UK, or UAE-based group that has structured its Cyprus investments through an EU holding company, you are not automatically exempt. If the underlying control rests outside the EU/EEA/Switzerland, the notification obligation can still apply.

The law does not affect EU/EEA or Swiss investors operating straightforward structures. If you are a German company acquiring a stake in a Cyprus business, this regime does not apply to you.

Key definition: Who is a 'foreign investor'?

•  Non-EU/EEA/Swiss natural persons

•  Entities incorporated outside the EU/EEA/Switzerland

•  EU-based entities that are ultimately controlled from outside the EU/EEA/Switzerland

•  The test is based on ultimate ownership and control — not just the immediate investor's address

What triggers a mandatory notification?

Not every investment by a non-EU investor requires notification. The law sets out a specific set of conditions that must all be met before the obligation kicks in.

The three cumulative triggers

First, the investor must be a foreign investor as defined above. Second, the target must be an 'undertaking of strategic importance' — a company active in one of the sectors listed in the law's annex (more on those below). Third, the transaction must result in the investor acquiring at least 25% of the share capital or voting rights, and the investment value must exceed €2 million.

All three conditions must be met simultaneously for a mandatory notification to be required. An investor acquiring a 10% stake in a strategic-sector company does not trigger the obligation. Neither does a €1.8 million investment that would take the stake to 25%.

Subsequent stake increases

There is an important exception to the €2 million threshold. If a foreign investor already holds a stake and is increasing it to cross either the 25% or 50% threshold, the notification obligation applies regardless of the transaction value. A €500,000 top-up that takes a stake from 24% to 26% is caught. This is designed to prevent gradual accumulation of influence as a way of avoiding the regime.

Trigger	Notification required?
New investment: ≥25% stake, ≥€2m, in strategic-sector entity	Yes
New investment: ≥25% stake, but value under €2m	No (but authority retains call-in power)
Existing stake being increased to ≥25% or ≥50%	Yes — regardless of transaction value
EU/EEA/Swiss investor, no third-country control	No
Non-EU investor, stake below 25%	No (but authority retains call-in power)

Which sectors are 'strategic'?

The law captures companies operating in sectors defined as strategically important to national security or public order. The list draws from Article 4 of EU Regulation 2019/452 and is expanded by an annex specific to Cyprus.

The core sectors include critical infrastructure (energy networks, water, transport, communications), critical technologies (AI, semiconductors, cybersecurity, space), sensitive data and access to personal data at scale, media (in the context of pluralism and freedom of information), financial services (banking, insurance, capital markets), defence and dual-use goods, and food security and essential inputs.

Cyprus has extended this list further in its national annex to include education, tourism, and land and real estate that is critical to key infrastructure.

A practical note: the law does not require a company to be exclusively or primarily active in these sectors. If a company's business includes activities in any of these areas — even alongside other commercial activities — it may be caught. The Ministry of Finance, as the competent authority, is expected to adopt a broad interpretation consistent with how other EU regulators have approached similar frameworks.

There is one explicit exemption: the purchase, sale, or construction of ships. This does not extend to floating storage and regasification units (FSRUs) for natural gas, which remain within scope.

Sectors covered by the Cyprus FDI screening regime

•  Critical infrastructure: energy, water, transport, communications, data storage

•  Critical technologies: AI, semiconductors, cybersecurity, robotics, aerospace

•  Sensitive data: access to personal data or commercially sensitive information at scale

•  Financial services: banking, insurance, payment systems, capital markets

•  Media: companies relevant to pluralism and freedom of information

•  Defence and dual-use technologies

•  Food security and essential inputs

•  Additionally under Cyprus national annex: education, tourism, and strategic real estate

How does the approval process work?

The Ministry of Finance is the competent authority responsible for reviewing notifications. It is supported by an Advisory Committee of seven ministries with relevant policy interests.

Phase 1: Initial screening

Once a complete notification is submitted, the Ministry has 20 working days to determine whether further review is required. If the investment raises no concerns, it can be cleared at this stage.

Phase 2: In-depth review

If the Ministry identifies potential concerns, the case proceeds to a Phase 2 review. At this stage, the file is circulated through the EU cooperation mechanism to other member states and the European Commission, who may submit comments or opinions. Cyprus is required to give those views due consideration, but they are not binding.

Phase 2 can last a maximum of 95 working days. The clock can be paused if the authority requests additional information — and such requests are common in complex transactions.

Outcomes

The Ministry can unconditionally approve the investment, approve it subject to conditions, or prohibit it. If a transaction is prohibited or conditions are imposed, the investor is informed within five working days of the decision.

A well-prepared, transparent filing from the outset significantly reduces the risk of a Phase 2 referral and the delays that follow. Regulators assess risk from what they see in the notification — incomplete or ambiguous submissions tend to attract more scrutiny, not less.

What if you don't notify — or don't need to?

The law gives the Ministry of Finance a call-in power to review transactions that were not subject to mandatory notification. This includes transactions that fell below the €2 million threshold, or where the investor holds a stake below 25%, if the authority has reasonable grounds to believe the investment could affect national security or public order.

This call-in right exists for up to 15 months from the date the investment completed — extended to five years if a mandatory notification was required but not submitted. Five years is a long time for a transaction to remain vulnerable to review. Investors relying on the argument that their deal did not trigger notification should be confident in that analysis before closing.

What are the penalties for non-compliance?

The law sets out a graduated penalty structure. Failure to file a required notification: up to €100,000. Providing false or misleading information during the review process: up to €500,000. Failing to comply with conditions imposed by the competent authority: up to €1,000,000, plus daily fines until compliance is achieved.

Beyond the financial penalties, the authority can also require an investment to be unwound — including reversing a completed acquisition. For corporate groups that have already integrated a Cyprus business into their operations, an unwind order creates significant practical and financial difficulties.

Practical implications for non-EU investors and international groups

The new regime changes the transaction planning calculus for any non-EU investor with Cyprus exposure. The most immediate practical consequences are as follows.

Transaction timelines need to change

Pre-closing approval is mandatory for notifiable deals. Investors cannot complete and then seek retroactive clearance. Long-stop dates in sale and purchase agreements — the outside date by which a deal must complete or lapse — need to account for a Phase 1 review of up to 20 working days and the possibility of a Phase 2 review extending to 95 working days. In practice, adding a minimum of three to four months to deal timelines for notifiable transactions is prudent planning.

Existing structures need reviewing

International groups that hold Cyprus subsidiaries, SPVs, or holding companies should assess whether those structures could be treated as undertakings of strategic importance. The question is not merely whether the Cyprus entity itself is strategic — it is whether the activities carried out through that entity, anywhere in the group, touch on the sectors listed in the law's annex. A Cyprus holding company for a UK technology business could, for example, attract scrutiny if the investment involves a sector covered by the law.

EU wrappers do not guarantee exemption

Groups that have historically routed investments through European holding companies on the assumption that EU registration provides regulatory shelter should revisit that assumption. If ultimate control lies outside the EU/EEA/Switzerland, the entity may be treated as a foreign investor for the purposes of this law. The test is substance and control, not incorporation address.

Confidentiality is protected

The law includes explicit protections for commercially sensitive information submitted as part of a notification. Information provided can only be used for the purpose of assessing the investment, and personal data must be processed in accordance with GDPR. This matters in practice — investors disclosing ownership structures, financing arrangements, and business plans need confidence that the information will be handled appropriately.

Where investment structuring advice becomes critical

The new regime does not change Cyprus's fundamental appeal as a jurisdiction. The corporate tax rate remains at 15%, the EU treaty network is intact, and the infrastructure for wealth management and cross-border structuring is well established. What changes is the compliance layer that sits alongside those benefits for certain categories of investor.

For non-EU investors considering Cyprus acquisitions or capital deployments in strategic sectors, the critical questions are: Does the investment trigger notification? If so, what information will the Ministry require and how can the filing be structured to minimise delay? How should transaction documents — heads of terms, SPAs, shareholder agreements — be drafted to address the regulatory timeline?

These are not questions with standard answers. They depend on the investor's ownership structure, the nature of the target's activities, the transaction mechanics, and the sector profile. Getting the analysis right at the outset is significantly less costly than discovering a filing requirement after the deal has been structured, or — worse — after it has completed.

At LCK, our advisory work in cross-border investment and corporate services means we are well placed to help investors assess their position under the new regime, prepare for the notification process, and structure transactions with the new compliance requirements built in from the start.

The bottom line

Cyprus has joined the mainstream of EU investment policy. FDI screening is no longer a foreign concept in this jurisdiction — it is now a legal requirement with real teeth.

For the vast majority of straightforward commercial transactions, this will not change much. A non-EU investor buying a small Cyprus services company below the €2 million threshold, or acquiring a minor stake in a business with no strategic-sector exposure, is not affected. The regime is targeted, not blanket.

But for non-EU investors acquiring meaningful stakes in companies operating in energy, technology, financial services, infrastructure, or any of the other listed sectors, the landscape has changed materially. The new law requires earlier planning, more transparent disclosure, and a longer transaction runway.

The law enters into force on 2 April 2026. For deals that are currently in progress or being planned, that date is close.

Assessing your position under the new FDI regime

If you are a non-EU investor with existing or planned exposure to Cyprus, now is the time to assess whether the new FDI Screening Law affects your structures and transaction plans. LCK advises on cross-border investment structuring, corporate services, and Cyprus regulatory matters.

Contact us: info@lckfs.com  |  www.lckfs.com